Why is authentication lost after refreshing my single page application?